In practice, NIS2 is a risk-based regulation. This means that companies must not only have controls in place but also be able to document that they understand the actual risks they face. In many organizations, this leads to a vast number of risk assessments that consume significant time without necessarily improving control or governance.
Our approach at Orkla Foods has been to simplify this process by clearly distinguishing between strategic and operational risks. At a high level, we have defined a limited set of strategic risks describing factors that could affect the business as a whole—such as production disruptions.
This prevents the various business units and 30+ factories from spending time individually arriving at the same risk scenario conclusion. The crucial step is understanding what could cause this to happen locally—for instance, identifying the local drivers that might trigger a production stoppage within a specific business unit.
This distinction also guides how we approach security. Although the impact of a risk scenario may be largely the same, the underlying causes differ, meaning that the security measures implemented must also vary accordingly.
This presentation focuses on how we have made risk the starting point for everything we do in information security—from setting priorities and implementing measures to how we manage and develop the organization's security level. The goal is not merely to comply with NIS2, but to use the requirements as a tool to approach security in a more targeted, efficient, and robust manner.
